diff --git a/Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c b/Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c
index af390b6..fccbfcb 100644
--- a/Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c
+++ b/Project/GateWay/source/Module/GateWay_Debug/DebugCmd.c
@@ -727,7 +727,7 @@ void DebugCmdSetCollTime(int argc, char *argv[])
 	}
 	
 	int time = atoi(argv[1]);
-	if(time < 10 && time > 7200) {
+	if(time < 10 || time > 7200) {
 		DBG_LOG("RS485 Cmd Para Error!\r\n");
 		return;
 	}
@@ -1024,7 +1024,7 @@ void DebugCmdSetCollectTime(int argc, char *argv[])
 	
 	int IntervalTime = atoi(argv[2]);
 	
-	if(IntervalTime < 10 && IntervalTime > 7200) {
+	if(IntervalTime < 10 || IntervalTime > 7200) {
 		DBG_LOG("SCT Cmd Para Error!\r\n");
 		return;
 	}
diff --git a/Project/GateWay/source/User/Src/Public.c b/Project/GateWay/source/User/Src/Public.c
index cd58bcd..66d4d0b 100644
--- a/Project/GateWay/source/User/Src/Public.c
+++ b/Project/GateWay/source/User/Src/Public.c
@@ -578,9 +578,9 @@ int CommUnitAnalyze(GateWayPara GateWay, uint8_t *rData, uint16_t rLen, SendData
 						MegData[2] = NET_COMM_CMD_ADD_UNIT;
             MegData[3] = (GateWay->ConfigPara.CommUnitArray[i].SensorN) & 0x00ff;;
 						MegData[4] = (GateWay->ConfigPara.CommUnitArray[i].SensorN >> 8) & 0x00ff;
-						for(uint8_t i = 0; i < GateWay->ConfigPara.CommUnitArray[i].SensorN; i++)
+						for(uint8_t k = 0; k < GateWay->ConfigPara.CommUnitArray[i].SensorN; k++)
 						{
-							memcpy(&MegData[5], GateWay->ConfigPara.CommUnitArray[i].Mac[i], 6);
+							memcpy(&MegData[5], GateWay->ConfigPara.CommUnitArray[i].Mac[k], 6);
 						}
 						CatOneEthSendQueue(MegData, PayLoadLen+5);
 						rt_free(MegData);
diff --git a/Project/GateWay/source/User/Src/RS485Task.c b/Project/GateWay/source/User/Src/RS485Task.c
index e848dbd..bf6efd9 100644
--- a/Project/GateWay/source/User/Src/RS485Task.c
+++ b/Project/GateWay/source/User/Src/RS485Task.c
@@ -227,7 +227,7 @@ void RS485CmdSend(GateWayPara GateWay, uint8_t CommUintAddr, SensorCommPara Sens
 {
 	SensorCommPara SC;
 	
-	if(CommUintAddr)
+	if(CommUintAddr == 1)
 		SC = &SComm1Para;
 	else
 		SC = &SComm2Para;
diff --git a/Project/GateWay/source/User/Src/main.c b/Project/GateWay/source/User/Src/main.c
index 0b95a18..6f99366 100644
--- a/Project/GateWay/source/User/Src/main.c
+++ b/Project/GateWay/source/User/Src/main.c
@@ -413,7 +413,7 @@ int main(void)
 		return -1;
 	
 	Debug_Thread = rt_thread_create("DebugUart", Debug_Thread_Entry, &GateWay, 2048, 3, 20);
-	if (RS485Ch2_Thread != RT_NULL)
+	if (Debug_Thread != RT_NULL)
 		rt_thread_startup(Debug_Thread);
 	else
 		return -1;
diff --git a/Project/GateWay/source/User/Src/protocol.c b/Project/GateWay/source/User/Src/protocol.c
index 1ab5277..2656b71 100644
--- a/Project/GateWay/source/User/Src/protocol.c
+++ b/Project/GateWay/source/User/Src/protocol.c
@@ -60,6 +60,10 @@ int protocol_unpack_frame(
     if (frame == NULL || slave_addr == NULL || command == NULL || payload_len == NULL) {
         return PROTOCOL_ERR_INVALID_PARAM;
     }
+    if (frame_len > 64) {
+        return PROTOCOL_ERR_BUFFER_OVERFLOW;
+    }
+
     if (frame_len < PROTOCOL_FRAME_MIN_SIZE) {
         return PROTOCOL_ERR_INVALID_PARAM;
     }
diff --git a/Project/GateWay/source/User/Src/spiflash.c b/Project/GateWay/source/User/Src/spiflash.c
index 147ca41..15226d8 100644
--- a/Project/GateWay/source/User/Src/spiflash.c
+++ b/Project/GateWay/source/User/Src/spiflash.c
@@ -332,7 +332,7 @@ void CheckDelSecter(uint32_t wAddr, uint16_t wLen)
 	while(1) {
 		SpiFlashReadAnyLengthData(LogBuff, ReadAddr, LOG_SAV_SIZE_MAX);
 		int i;
-		for(i = 0; i < LOG_SAV_SIZE_MAX; i++) {
+		for(i = 0; i <= LOG_SAV_SIZE_MAX - 4; i++) {
 			if(memcmp(&LogBuff[i], SavFlag, 4) == 0) {
 				SetFirstLogStartAddr(ReadAddr + i);
 				return;;